tcpaccept - Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.

       Brendan Gregg

       This tool traces passive TCP connections (eg, via an accept() syscall; connect() are active connections).
       This can be useful for general troubleshooting to see what new connections the local server is accepting.

       This  uses  dynamic  tracing  of the kernel inet_csk_accept() socket function (from tcp_prot.accept), and
       will need to be modified to match kernel changes.

       This tool only traces successful TCP accept()s. Connection attempts to closed ports  will  not  be  shown
       (those can be traced via other functions).

       Since this uses BPF, only the root user can use this tool.

       Trace all passive TCP connections (accept()s):
              # tcpaccept

       Trace all TCP accepts, and include timestamps:
              # tcpaccept-t

       Trace connections to local ports 80 and 81 only:
              # tcpaccept-P80,81

       Trace PID 181 only:
              # tcpaccept-p181

       Trace IPv4 family only:
              # tcpaccept-4

       Trace IPv6 family only:
              # tcpaccept-6

       Trace a set of cgroups only (see special_filtering.md from bcc sources for more details):
              # tcpaccept--cgroupmap/sys/fs/bpf/test01

       TIME   Time of the event, in HH:MM:SS format.

       TIME(s)
              Time of the event, in seconds.

       PID    Process ID

       COMM   Process name

       IP     IP address family (4 or 6)

       RADDR  Remote IP address.

       RPORT  Remote port

       LADDR  Local IP address.

       LPORT  Local port

       tcpaccept - Trace TCP passive connections (accept()). Uses Linux eBPF/bcc.

       -h     Print usage message.

       -T     Include a time column on output (HH:MM:SS).

       -t     Include a timestamp column.

       -p PID Trace this process ID only (filtered in-kernel).

       -P PORTS
              Comma-separated list of local ports to trace (filtered in-kernel).

       -4     Trace IPv4 family only.

       -6     Trace IPv6 family only.

       --cgroupmap MAPPATH
              Trace cgroups in this BPF map only (filtered in-kernel).

       --mntnsmap  MAPPATH
              Trace mount namespaces in this BPF map only (filtered in-kernel).

       Linux

       This  traces  the  kernel  inet_csk_accept  function  and prints output for each event.  The rate of this
       depends on your server application. If it is a web or proxy server accepting many tens  of  thousands  of
       connections  per  second,  then the overhead of this tool may be measurable (although, still a lot better
       than tracing every packet). If it is less than a thousand a second, then the overhead is expected  to  be
       negligible. Test and understand this overhead before use.

       CONFIG_BPF and bcc.

tcptracer(8), tcpconnect(8), funccount(8), tcpdump(8)

USER COMMANDS                                      2020-02-20                                       tcpaccept(8)

       This is from bcc.

              https://github.com/iovisor/bcc

       Also  look  in  the bcc distribution for a companion _examples.txt file containing example usage, output,
       and commentary for this tool.

       Unstable - in development.

tcpaccept[-h][-T][-t][-pPID][-PPORTS][-4|-6][--cgroupmapMAPPATH][--mntnsmapMAPPATH]